Trust Policies | John Nessime

AI-Generated IAM Policies: Where the Hard Boundary Belongs

Post category:Cloud Computing Cloud Security DevOps

A generated policy with no wildcards can still hand over your account. Here are the three failure shapes that survive human review, why the review step is the wrong place to put your defence, and how to build a ceiling that holds regardless of what the model writes.

EKS Pod Identity vs IRSA: What Actually Decides the Choice

Post category:Cloud Security Containers Security Kubernetes

Both give your pods short-lived AWS credentials, but they put the cluster-to-role relationship in completely different places. A practical comparison of EKS Pod Identity vs IRSA: where each one wins, where each refuses to run, the silent node-role fallback that hides broken wiring, and a decision procedure you can apply per workload.